Summary

By monitoring the average bounty amounts of a team, you can infer a certain amount of information about the size of the bounties awarded, even if the team has chosen not to show bounty amounts. we have decided to close this report as Informative as we are okay with the current state of the bounty reward metrics and the information displayed. In coming to this decision, we looked at a few key factors:

• severity
• size of the affected area
• practicality of a fix

Severity

The severity of this information disclosure is extremely low in that only the first bounty amount would be revealed. It does not reveal the values of any subsequent bounties.

Size of Affected Area

Again, the affected area is very small. More specifically, this information is revealed in the very specific case of a program that was previously private, that never offered bounties while in private, that later went public and switched to offering bounties.

Practicality of a Fix

For us, this is the factor that ties it all together. While we could push out a fix that would fudge the numbers or wait to calculate the Average Bounty, there are many other ways this information could be obtained. A researcher could tweet or write an blog post about it. An enterprising hacker could scrape the site and reverse engineer the amounts based on the average that is displayed by utilizing any combination of other platform-wide numbers that are publicly available. Therefore we believe that this specific case can't be meaningfully mitigated by any single fix; in particular, clobbering the bounty metrics here limits one of the vectors, but still makes it easy to utilize any remaining ones.